When choosing a time and attendance (PDKS) device, the first question is usually "fingerprint or facial recognition?" The right first question, however, is this: do I need to collect this data at all? Türkiye's Personal Data Protection Law No. 6698 (KVKK) classifies biometric data as special category personal data and allows it to be processed only under specific conditions. Collecting biometric data for a task like attendance tracking, whose purpose can be achieved with less intrusive methods, is both a legal risk and an unnecessary liability.
In this article we explain why biometrics belong to a different category, how the principle of proportionality affects your choice of time and attendance system, and how to build a reliable setup without biometrics. This article is not legal advice; your organization's data protection advisor or lawyer makes the final assessment.
Why is biometric data different?
Data such as fingerprints, faces and irises identify a person in a way that is unique and unchangeable. A leaked password can be changed; a leaked fingerprint cannot. That is why the law places biometric data in the same category as health and religious data: processing requires explicit consent or one of the narrow exceptions set out in the law, and the additional security measures defined by the Turkish Data Protection Authority must also be in place.
In an employment relationship, "explicit consent" is a debate of its own: it is questionable whether an employee can give consent to an employer of their own free will. A setup that relies on consent collapses the moment consent is withdrawn.
Proportionality: reaching the purpose with the least data
One of the general principles of KVKK is that data must be relevant, limited and proportionate to the purpose for which it is processed. The purpose of attendance tracking is to keep a reliable record that "this person was here at this time." If that purpose can be achieved with cards, QR codes and location verification, collecting biometric data is not compatible with the principle of proportionality. Publicly available decisions of the Turkish Data Protection Authority include unfavorable assessments of biometric data being used for employee tracking where less intrusive methods were available. We recommend reviewing the latest decisions with your organization's advisor.
How do you ensure reliability without biometrics?
The worry that "without fingerprints, everyone will swipe a colleague's card" is a holdover from the old model, where control relied on a single piece of evidence. Reliability comes from several simple checks working together:
- Card access: the card is tied to a person and to authorized access points; every pass records the point and the time, and passes at a different branch are reported separately.
- Mobile QR + location + device: the site QR code (optionally dynamic), the phone's location and the single device paired to the employee are verified together. No one can clock in from a colleague's phone.
- Audit reports: manual edit logs, employees who forgot to clock in or out, who is on site right now and per-person activity lists make inconsistencies visible.
- Card lifecycle: a departing employee's card is removed from the devices within seconds, eliminating the risk of a "card left active."
This combination is as reliable as biometrics, and it does not collect any unchangeable data about the employee.
Checklist for a KVKK-compliant time and attendance system
Data collected
- Only the fields you need: full name, employee ID, position, site, card number, email/phone (for app sign-in).
- Location only at the moment of an action (clock-in/clock-out) and only at sites the organization has enabled; no all-day tracking.
- No biometric data.
Privacy notice and records
- A privacy notice for employees: what data, for what purpose, for how long, and with whom it is shared.
- A time and attendance entry in the data processing inventory; kept up to date if you are subject to VERBIS (the Turkish data controllers' registry) obligations.
- Provisions on attendance tracking in the employment contract or internal regulations.
Access and security
- Role-based permissions: a branch manager sees their own branch, a subcontractor supervisor sees their own company, HR sees everything.
- Every manual edit is logged with who, when and why.
- Documents such as medical reports are kept in the personnel file, visible only to authorized roles.
- Each account is paired with a single device; device changes require manager approval.
Retention and disposal
- Retention periods are defined (taking employment law obligations and potential disputes into account, together with your advisor).
- A departing employee's account is deactivated and their card revoked; the disposal policy is applied when the retention period ends.
Cameras and time and attendance: keep them separate
Combining security cameras with attendance tracking, recording entries through facial recognition, merges two separate processing purposes into a single system and opens the biometric data debate head-on. Attendance tracking does not need camera footage; if you have security cameras, manage them separately with their own privacy notice and their own retention period.
The NetKurum approach
NetKurum does not collect biometric data: attendance is tracked through card access and mobile clock-in verified by QR code, location and device. Location is checked only at the moment of an action, and only if it has been enabled for the site. Page permissions are tied to position and role, and data scope to site and company; manual edits are kept in a separate report, and documents in the personnel file are protected by permissions. Learn more: Access Management and Entry-Exit Management.
The safest personal data is the data that was never collected. You do not have to collect unchangeable data to track attendance.
Frequently asked questions
Can fingerprints be used if the employee gives explicit consent?
This is a legally contested area: the freedom of consent in an employment relationship and the principle of proportionality are assessed together. When a less intrusive method exists, there is no need for biometrics; ask your advisor.
Is collecting location data compliant with KVKK?
Yes, as long as it is limited to the purpose, proportionate and covered by a privacy notice: only at the moment of an action, only at sites the organization has enabled, and without all-day tracking.
Is a card number personal data?
Yes, because it can be linked to a person; but it is not biometric, it can be changed and it is proportionate. It falls under the standard personal data regime.
Who prepares the privacy notice?
The organization's data protection advisor; the software provider supports them by documenting which data is processed and how.
Build proportionate attendance tracking
We can review your current devices and data flows together. Contact us or, for mobile clock-in, start your free trial.
About the author
Zeynep Çelik
Digital Content Specialist
Covers technology, integrations and field deployments on the NetKurum blog. She explains cloud time and attendance, connectivity devices and real customer experiences with clear examples.
